4 vulnerabilities across 4 products scored HIGH or above on November 07, 2026.

  • 🟠 HIGH: 4

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-119977 (wordpress/wordpress) — F1: exploitable → itw, AAS: 10.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-10-31 bulletin.

🟠 [HIGH] themegrill/registration_form_for_woocommerce

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:themegrill:registration_form_for_woocommerce:*:*:*:*:*:*:*:* (< 1.1.5)

ThemeGrill Registration Form for WooCommerce — Critical Privilege Escalation

One critical-severity vulnerability (CVE-2026-119075, CVSS 9.8) affects the Registration Form for WooCommerce plugin by ThemeGrill, versions up to and including 1.1.4. The flaw allows unauthenticated attackers to escalate privileges during WooCommerce checkout registration by submitting arbitrary user role values, bypassing the role allow-list validation that is correctly enforced on the My Account registration path but missing from the checkout validation handler. This is confirmed exploitable and requires no authentication.

WordPress site administrators using this plugin should update immediately to a patched version. Any site that enables user registration through WooCommerce checkout is directly at risk of full account takeover, including administrative access. Review user accounts for any unauthorized role assignments that may indicate prior exploitation.

Vendor Advisory

🟠 [HIGH] latepoint/appointment_booking_plugin_–latepoint|calendar&_scheduling_for_wordpress

1 CVE | CVSS 3.1: 9.1 | AAS 9.4

  • cpe:2.3:a:latepoint:appointment_booking_plugin_latepoint_calendar_scheduling_for_wordpress:*:*:*:*:*:*:*:* (< 5.7.7)

LatePoint Appointment Booking Plugin — Critical Authentication Bypass

One critical-severity vulnerability (CVE-2026-118066, CVSS 9.1) affects the LatePoint Appointment Booking and Scheduling plugin for WordPress in all versions up to and including 5.7.6. The flaw exists in the OsModel::build_conditions_query() function, which compares WHERE-clause values against literal SQL keywords and concatenates matches directly into queries without parameterized binding, enabling an attacker to bypass authentication and take over arbitrary user accounts without valid credentials. This is confirmed exploitable and requires no prior authentication.

WordPress administrators running the LatePoint plugin should update to a patched version immediately. Sites offering online appointment booking through this plugin are directly exposed to full account takeover, potentially compromising customer data, booking records, and administrative access. Audit recent login activity and session records for signs of unauthorized access.

Vendor Advisory

🟠 [HIGH] blubrry_podcasting/powerpress_podcasting

1 CVE | CVSS 3.1: 8.8 | AAS 9.1

  • cpe:2.3:a:blubrry_podcasting:powerpress_podcasting:*:*:*:*:*:*:*:*

Blubrry PowerPress Podcasting — High-Severity Cross-Site Request Forgery

One high-severity vulnerability (CVE-2026-121762, CVSS 8.8) affects the PowerPress Podcasting plugin by Blubrry for WordPress in all versions through 11.18.0. The plugin lacks proper CSRF token validation, allowing an attacker to craft malicious requests that execute privileged plugin actions when an authenticated administrator visits a specially crafted page or clicks a malicious link.

WordPress site administrators using PowerPress Podcasting should update beyond version 11.18.0 as soon as a patched release is available. Given the plugin’s wide adoption in the podcasting community, sites with contributor or editor accounts are particularly at risk of unauthorized configuration changes or content manipulation through forged requests. Review plugin settings for any unexpected modifications if running an affected version.

Vendor Advisory

🟠 [HIGH] suplugins/superb_addons:_blocks,patterns&_theme_designer

1 CVE | CVSS 3.1: 8.8 | AAS 9.1

  • cpe:2.3:a:suplugins:superb_addons_blocks_patterns_amp_theme_designer:*:*:*:*:*:*:*:* (< 4.2.5)

Suplugins Superb Addons — High-Severity Cross-Site Request Forgery

One high-severity vulnerability (CVE-2026-66669, CVSS 8.8) affects the Superb Addons: Blocks, Patterns and Theme Designer plugin by Suplugins for WordPress in all versions through 4.2.4. The plugin fails to properly verify request origins through nonce validation, enabling an attacker to trick an authenticated administrator into unknowingly executing privileged plugin operations by visiting a malicious webpage or clicking a crafted link.

WordPress administrators using Superb Addons should update beyond version 4.2.4 as soon as a fix is available. Sites relying on this plugin for block patterns and theme customization should review recent configuration changes for any unauthorized modifications. Until patched, administrators should exercise caution with unfamiliar links while logged into WordPress.

Vendor Advisory